The U.S. House Homeland Security Committee has requested testimony from Instructure, the parent company of the Canvas educational platform, following two distinct cyberattacks that compromised the personal data of millions of users.

美國眾議院國土安全委員會要求 Canvas 教育平台的母公司 Instructure 提供證詞，主因是兩次獨立的網路攻擊導致數百萬用戶的個人資料外洩。

The security failures commenced on April 29, when the threat actor collective known as ShinyHunters exploited a vulnerability associated with 'Free-For-Teacher' accounts. This initial penetration facilitated the exfiltration of usernames, email addresses, course designations, and enrollment data. A subsequent breach occurred on May 7, during which the actors defaced login interfaces, necessitating a temporary transition of the platform into maintenance mode. The scale of the incident is substantial, with the perpetrators claiming to have targeted approximately 9,000 educational institutions, thereby potentially exposing the sensitive information of minors.

安全漏洞始於 4 月 29 日，當時名為 ShinyHunters 的威脅組織利用了與「教師免費」帳戶相關的漏洞。此次初步滲透導致用戶名稱、電子郵件地址、課程名稱及入學資料被外洩。隨後在 5 月 7 日發生第二次入侵，攻擊者毀損了登入介面，導致平台必須暫時切換至維護模式。此次事件規模龐大，犯罪者聲稱目標約為 9,000 所教育機構，因此可能導致未成年人的敏感資訊外洩。

In a departure from established cybersecurity protocols advocated by the FBI and industry specialists, Instructure entered into a financial agreement with ShinyHunters. The company asserts that this rapprochement ensured the deletion of stolen data, citing the receipt of 'shred logs' as verification. However, external analysts, including Troy Hunt, have questioned the validity of such logs, noting that the retention of clandestine copies is a common practice among ransomware collectives. This skepticism is reinforced by the precedent of the PowerSchool breach in 2024, where ransom payments failed to prevent subsequent extortion attempts.

Instructure 採取了與 FBI 及業界專家建議的網路安全標準流程不同的做法，與 ShinyHunters 達成了金錢協議。公司聲稱這種協調確保了被盜資料被刪除，並以收到「銷毀日誌」作為驗證。然而，包括 Troy Hunt 在內的外部分析師質疑此類日誌的有效性，指出保留秘密副本是勒索軟體組織的常見做法。2024 年 PowerSchool 漏洞事件的先例進一步強化了這種懷疑，當時支付贖金並未能防止隨後的勒索企圖。

Consequently, Representative Andrew Garbarino, chair of the House Homeland Security Committee, has initiated an investigation into the adequacy of Instructure's coordination with the Cybersecurity and Infrastructure Security Agency (CISA). The committee's inquiry focuses on the company's failure to contain the threat actor after the primary intrusion and the systemic vulnerabilities inherent in the vendor's incident response capabilities. While Instructure has disabled the compromised account type and intends to conduct customer webinars, the institutional implications of its payment to the hackers remain a point of critical contention.

因此，眾議院國土安全委員會主席 Andrew Garbarino 議員已對 Instructure 與網路安全和基礎設施安全局 (CISA) 的協調是否充分啟動調查。委員會的調查重點在於公司在首次入侵後未能遏制威脅者，以及該供應商在事件應對能力中固有的系統性漏洞。雖然 Instructure 已停用受影響的帳戶類型並計劃為客戶舉辦網路研討會，但其向駭客支付款項的體制影響仍是一個關鍵的爭議點。

Instructure's systems are currently operational, though the company remains under legislative scrutiny regarding its data protection failures and its decision to pay a ransom.

Instructure 的系統目前運作正常，但公司在資料保護失職以及決定支付贖金方面，仍受到立法機關的審查。